diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.gitignore b/.gitignore index 85eaeca..e0500d1 100644 --- a/.gitignore +++ b/.gitignore @@ -109,3 +109,18 @@ setroubleshoot-plugins-2.1.55.tar.gz /setroubleshoot-plugins-3.0.58.tar.gz /setroubleshoot-plugins-3.0.59.tar.gz /setroubleshoot-plugins-3.0.60.tar.gz +/setroubleshoot-plugins-3.0.61.tar.gz +/setroubleshoot-plugins-3.3.1.tar.gz +/setroubleshoot-plugins-3.3.2.tar.gz +/setroubleshoot-plugins-3.3.3.tar.gz +/setroubleshoot-plugins-3.3.4.tar.gz +/setroubleshoot-plugins-3.3.5.1.tar.gz +/setroubleshoot-plugins-3.3.6.tar.gz +/setroubleshoot-plugins-3.3.7.tar.gz +/setroubleshoot-plugins-3.3.8.tar.gz +/setroubleshoot-plugins-3.3.9.tar.gz +/setroubleshoot-plugins-3.3.10.tar.gz +/setroubleshoot-plugins-3.3.11.tar.gz +/setroubleshoot-plugins-3.3.12.tar.gz +/setroubleshoot-plugins-3.3.14.tar.gz +/setroubleshoot-plugins-3.3.15.tar.gz diff --git a/0001-Split-multi-command-fix_cmds-into-lists.patch b/0001-Split-multi-command-fix_cmds-into-lists.patch new file mode 100644 index 0000000..476333d --- /dev/null +++ b/0001-Split-multi-command-fix_cmds-into-lists.patch @@ -0,0 +1,73 @@ +From df90bf242b35a9e01f721dd7ad436f1bd5d21616 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 9 Mar 2026 22:03:31 +0100 +Subject: [PATCH] Split multi-command fix_cmds into lists + +This requires +https://gitlab.com/setroubleshoot/setroubleshoot/-/merge_requests/54/diffs?commit_id=d5d13afa86c2bd03952c04a187657ed981c9be7e +to work properly! +--- + src/allow_execmod.py | 3 ++- + src/automount_exec_config.py | 3 ++- + src/cvs_data.py | 3 ++- + src/file.py | 2 +- + 4 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/src/allow_execmod.py b/src/allow_execmod.py +index 6e1f6bf..0a3995f 100644 +--- a/src/allow_execmod.py ++++ b/src/allow_execmod.py +@@ -81,7 +81,8 @@ If you want this to survive a relabel, execute + # semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH';restorecon -v '$FIX_TARGET_PATH' + """ + +- fix_cmd = """/usr/sbin/semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'""" ++ fix_cmd = ["""/usr/sbin/semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH'""", ++ """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""] + + def init_args(self, args): + if len(args) > 0: +diff --git a/src/automount_exec_config.py b/src/automount_exec_config.py +index a64eaf2..81ada8e 100644 +--- a/src/automount_exec_config.py ++++ b/src/automount_exec_config.py +@@ -40,7 +40,8 @@ class plugin(Plugin): + If you want to change the file context of $TARGET_PATH so that the automounter can execute it you can execute "chcon -t bin_t $TARGET_PATH". If you want this to survive a relabel, you need to permanently change the file context: execute "semanage fcontext -a -t bin_t '$FIX_TARGET_PATH'". + ''') + +- fix_cmd = """/usr/sbin/semanage fcontext -a -t bin_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'""" ++ fix_cmd = ["""/usr/sbin/semanage fcontext -a -t bin_t '$FIX_TARGET_PATH'""", ++ """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""] + + if_text = 'If you want to allow automounter to execute $TARGET_PATH' + +diff --git a/src/cvs_data.py b/src/cvs_data.py +index 7451622..1e75ead 100644 +--- a/src/cvs_data.py ++++ b/src/cvs_data.py +@@ -46,7 +46,8 @@ class plugin(Plugin): + do_text = """# semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH' + # restorecon -v '$FIX_TARGET_PATH'""" + +- fix_cmd = """/usr/sbin/semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'""" ++ fix_cmd = ["""/usr/sbin/semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH'""", ++ """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""] + + def __init__(self): + Plugin.__init__(self, __name__) +diff --git a/src/file.py b/src/file.py +index ac24bf9..25f3a43 100644 +--- a/src/file.py ++++ b/src/file.py +@@ -66,7 +66,7 @@ home directory from a previous installation that did not use SELinux, 'restoreco + if args == (1,0): + return '/sbin/restorecon -R -v $TARGET_PATH' + else: +- return 'touch /.autorelabel; reboot' ++ return ['touch /.autorelabel', 'reboot'] + + def init_args(self, args): + if args == (1,0): +-- +2.53.0 + diff --git a/0002-catchall-Discourage-creating-custom-policy-modules.patch b/0002-catchall-Discourage-creating-custom-policy-modules.patch new file mode 100644 index 0000000..a3f28a1 --- /dev/null +++ b/0002-catchall-Discourage-creating-custom-policy-modules.patch @@ -0,0 +1,36 @@ +From 8ad7f4c5528fbbc52a3d391c702102c6fe262d83 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Tue, 9 Jun 2026 17:27:36 +0200 +Subject: [PATCH] catchall: Discourage creating custom policy modules + +Update the plugin text to discourage creating custom policy modules by +explaining the lack of support and potential security implications. +--- + src/catchall.py | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/src/catchall.py b/src/catchall.py +index 052d6d8..7e4a8fa 100644 +--- a/src/catchall.py ++++ b/src/catchall.py +@@ -54,9 +54,14 @@ class plugin(Plugin): + return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on $TARGET_CLASS labeled $TARGET_TYPE by default.') + return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on the $TARGET_BASE_PATH $TARGET_CLASS by default.') + +- then_text = _('You should report this as a bug.\nYou can generate a local policy module to allow this access.') +- do_text = _("""Allow this access for now by executing: +-# ausearch -c '$SOURCE' --raw | audit2allow -M my-$MODULE_NAME ++ then_text = _(''' ++ You should report this as a bug.\n ++ If you are certain this access is legitimate and not an intrusion attempt, you ++ can generate a local policy module to allow it. ++ Custom policy modules are not supported as they may weaken the system policy and expose the system to security vulnerabilities. ++ ''') ++ ++ do_text = _("""# ausearch -c '$SOURCE' --raw | audit2allow -M my-$MODULE_NAME + # semodule -X 300 -i my-$MODULE_NAME.pp""") + + def __init__(self): +-- +2.53.0 + diff --git a/plans/tests.fmf b/plans/tests.fmf new file mode 100644 index 0000000..5d615ae --- /dev/null +++ b/plans/tests.fmf @@ -0,0 +1,8 @@ +summary: basic setroubleshoot-plugins test plan +discover: + how: fmf + url: https://gitlab.com/setroubleshoot/tests.git + filter: "component:setroubleshoot-plugins & tier: 1" +execute: + how: tmt + diff --git a/setroubleshoot-plugins.spec b/setroubleshoot-plugins.spec index fbefed1..8ec5c8f 100644 --- a/setroubleshoot-plugins.spec +++ b/setroubleshoot-plugins.spec @@ -1,21 +1,30 @@ %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}} +# Disable automatic compilation of Python files in extra directories +%global _python_bytecompile_extra 0 + Summary: Analysis plugins for use with setroubleshoot Name: setroubleshoot-plugins -Version: 3.0.60 -Release: 2%{?dist} -License: GPLv2+ -Group: Applications/System -URL: https://fedorahosted.org/setroubleshoot -# git clone git://git.fedorahosted.org/git/setroubleshoot.git; cd setroubleshoot -# git archive --prefix setroubleshoot-plugins-3.0.10/426cf8ea7a38e8c5179981219d831368161b65f2 > setroubleshoot-plugins-3.0.10.tar.gz -Source0: %{name}-%{version}.tar.gz -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +Version: 3.3.15 +Release: 8%{?dist} +License: GPL-2.0-or-later +URL: https://gitlab.com/setroubleshoot/plugins +VCS: git:https://gitlab.com/setroubleshoot/plugins.git +Source0: https://gitlab.com/-/project/24478430/uploads/1d856bff1c9fb16a8c6fc877d7fe91ca/setroubleshoot-plugins-3.3.15.tar.gz +# git format-patch -N setroubleshoot-plugins- +# for j in 00*patch; do printf "Patch: %s\n" $j; done +Patch: 0001-Split-multi-command-fix_cmds-into-lists.patch +Patch: 0002-catchall-Discourage-creating-custom-policy-modules.patch BuildArch: noarch +# gcc is needed only for ./configure +# Remove it when the build process is fixed +BuildRequires: gcc +BuildRequires: make BuildRequires: perl-XML-Parser -BuildRequires: intltool gettext python -Requires: setroubleshoot-server >= 3.1.16-1 +BuildRequires: intltool gettext python3-devel +# Support for multiple commands in fix_cmd +Conflicts: setroubleshoot-server < 3.3.37 %description This package provides a set of analysis plugins for use with @@ -24,30 +33,202 @@ data and system data to provide user friendly reports describing how to interpret SELinux AVC denials. %prep -%setup -q +%autosetup -p 1 %build -%configure -make +%configure PYTHON=%{__python3} +make PYTHON=%{__python3} %install rm -rf %{buildroot} -make DESTDIR=%{buildroot} pkgdocdir=%{_pkgdocdir} install +%make_install PYTHON=%{__python3} pkgdocdir=%{_pkgdocdir} %find_lang %{name} - -%clean -rm -rf %{buildroot} +# Manually invoke the python byte compile macro for each path that needs byte +# compilation. +%py_byte_compile %{__python3} %{buildroot}%{_datadir}/setroubleshoot/plugins %files -f %{name}.lang -%defattr(-,root,root,-) %doc %{_pkgdocdir} %{_datadir}/setroubleshoot/plugins %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 3.3.15-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Thu May 07 2026 Vit Mojzis - 3.3.15-7 +- Split multi-command fix_cmds into lists +- catchall: Discourage creating custom policy modules + +* Sat Jan 17 2026 Fedora Release Engineering - 3.3.15-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Fri Sep 19 2025 Python Maint - 3.3.15-5 +- Rebuilt for Python 3.14.0rc3 bytecode + +* Fri Aug 15 2025 Python Maint - 3.3.15-4 +- Rebuilt for Python 3.14.0rc2 bytecode + +* Fri Jul 25 2025 Fedora Release Engineering - 3.3.15-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Sun Jan 19 2025 Fedora Release Engineering - 3.3.15-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Mon Jan 06 2025 Petr Lautrbach - 3.3.15-1 +- restorecon.py: exclude more paths +- Improve disable_ipv6 plugin then_text +- Update generated configuration files +- Update translations + +* Sat Jul 20 2024 Fedora Release Engineering - 3.3.14-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Sat Jan 27 2024 Fedora Release Engineering - 3.3.14-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Wed Jul 26 2023 Petr Lautrbach - 3.3.14-8 +- Update generated configuration files (rhbz#2226425) +- Improve disable_ipv6 plugin then_text + +* Sat Jul 22 2023 Fedora Release Engineering - 3.3.14-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Sat Jan 21 2023 Fedora Release Engineering - 3.3.14-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Sat Jul 23 2022 Fedora Release Engineering - 3.3.14-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Sat Jan 22 2022 Fedora Release Engineering - 3.3.14-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Fri Sep 3 2021 Petr Lautrbach - 3.3.14-3 +- restorecon.py: exclude more paths (#1960136) + +* Fri Jul 23 2021 Fedora Release Engineering - 3.3.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Mon Mar 29 2021 Vit Mojzis - 3.3.14-1 +- Update translations + +* Wed Jan 27 2021 Fedora Release Engineering - 3.3.12-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Jul 29 2020 Fedora Release Engineering - 3.3.12-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 14 2020 Tom Stellard - 3.3.12-2 +- Use make macros +- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro + +* Tue Apr 21 2020 Vit Mojzis - 3.3.12-1 +- Use get_package_nvr* functions instead of get_rpm_nvr* +- Update deprecated type references +- Update translations + +* Thu Jan 30 2020 Vit Mojzis - 3.3.11-1 +- Add plugin which analyzes execmem denials +- Add missing "If " strings +- Update qemu_blk_image and qemu_file_image +- Update "xen_image" plugin +- Update "file" plugin +- Update "missing" scripts to automake-1.15 + +* Thu Jan 30 2020 Fedora Release Engineering - 3.3.10-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Fri Jul 26 2019 Fedora Release Engineering - 3.3.10-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Sat Feb 02 2019 Fedora Release Engineering - 3.3.10-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Sat Dec 8 2018 Petr Lautrbach - 3.3.10-1 +- Handle no "allowed_target_types" properly +- bind_ports: Do not use when there are no allowed_target_types +- Fix summary and "if" text for AVCs with unknown target path +- plugins: Update translations + +* Sat Jul 14 2018 Fedora Release Engineering - 3.3.9-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Tue Jun 19 2018 Miro Hrončok - 3.3.9-5 +- Rebuilt for Python 3.7 + +* Fri Feb 09 2018 Fedora Release Engineering - 3.3.9-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Thu Nov 23 2017 Petr Lautrbach - 3.3.9-3 +- Update translations + +* Mon Nov 20 2017 Petr Lautrbach - 3.3.9-2 +- Update translations + +* Sat Nov 18 2017 Petr Lautrbach - 3.3.9-1 +- Fix catchall plugin message for process2 + +* Fri Sep 15 2017 Petr Lautrbach - 3.3.8-1 +- Do not split If sentences to framework and plugins - requires + setroubleshoot 3.3.13 at least - (rhbz#1210243, rhbz#1322734, rhbz#1115510) +- Update translations + +* Thu Jul 27 2017 Fedora Release Engineering - 3.3.7-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Tue Jun 13 2017 Petr Lautrbach - 3.3.7-1 +- cvs_data: Add "fix_cmd" and enable "fix" button +- chrome: Update "fix_cmd" and enable "fix" button +- automount_exec_config: Update messages and enable "fix" button +- allow_ftpd_use_*: Update messages and enable "fix" button +- allow_execmod: Update messages and enable "fix" button +- catchall_boolean: fix import of boolean_desc (#1444549) +- restorecon: fix "then" text +- Spelling fixes + +* Sat Feb 11 2017 Fedora Release Engineering - 3.3.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Thu Sep 01 2016 Petr Lautrbach 3.3.6-1 +- Fix catchall plugin message for capability2 (#1360392) +- Stop executing restorecon plugin on specified path prefixes (#1270778) +- Update translations + +* Wed Jun 22 2016 Petr Lautrbach - 3.3.5.1-1 +- Catch all subprocess exceptions +- Use subprocess.check_output() with a sequence of program arguments +- Fix location of selinuxfs mount point + +* Fri May 06 2016 Petr Lautrbach - 3.3.4-1 +- Suggest my-.pp modules instead of mypol.pp (#1329037) +- Suggest priority 300 for modules created by audit2allow + +* Mon Apr 04 2016 Petr Lautrbach - 3.3.3-1 +- Fix sshd_root.py setroubleshoot plugin to cover only /root/.ssh path as intended. +- Suggest to use ausearch instead of grep +- Update translations + +* Thu Feb 04 2016 Fedora Release Engineering - 3.3.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Tue Nov 10 2015 Fedora Release Engineering - 3.3.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5 + +* Tue Oct 06 2015 Petr Lautrbach 3.3.2-1 +- Update restorecon plugin to to identify a mislabeling of executable (BZ#1257682) + +* Tue Aug 18 2015 Petr Lautrbach 3.3.1-0.1 +- port setroubleshoot-plugins to Python 3 + +* Fri Jun 19 2015 Fedora Release Engineering - 3.0.61-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Mon Feb 16 2015 Miroslav Grepl - 3.0.61-1 +- Fix catchall_boolean plugin to show correct man page for source type. + * Sun Jun 08 2014 Fedora Release Engineering - 3.0.60-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild -* Mon Jan 23 2014 Dan Walsh - 3.0.60-1 +* Thu Jan 23 2014 Dan Walsh - 3.0.60-1 - Change file.py plugin to handle alias between file_t and unlabeled_t * Wed Dec 4 2013 Dan Walsh - 3.0.59-1 diff --git a/sources b/sources index a6b5c2d..aeb5a6c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -81c99c2f77c9f155703ed4be1e1f00fa setroubleshoot-plugins-3.0.60.tar.gz +SHA512 (setroubleshoot-plugins-3.3.15.tar.gz) = 9741ecd48a7e0cde376ac0f818d94dad32c74acd2afc01ec6f5e3cf74ff9075d4f3406f1a3905cbbdd3833c8c2ef4213deaaf00d0012dbea582eb2b825618d5f